@withbuddi/buddi 0.1.0-pre.35 → 0.1.0-pre.37

package/node_modules/@buddi/core/dist/host/http.js

@@ -200,6 +200,116 @@ export function registerHttpUrlDestination() {
 export function isOwnUrlBinding(binding, plugin) {
     return binding.kind === HTTP_URL_KIND && asUrlTarget(binding.target)?.plugin === plugin;
 }
+/* ------------------------------------------------------------------ *
+ * The `http.basic` destination (since host API 1.26)
+ * ------------------------------------------------------------------ */
+/**
+ * Core's own Basic-auth destination (docs/owner-secrets.md §3): a secret that
+ * is a password, sent as `Authorization: Basic base64(username:password)` to
+ * the hosts its binding names — a CalDAV account's app-specific password. The
+ * plugin names the user (it is not the secret); core reads the password,
+ * builds the header after the address checks and inserts it, so the plugin
+ * never holds the password.
+ */
+export const HTTP_BASIC_KIND = 'http.basic';
+/** The methods a Basic-auth request may use: reads and the WebDAV verbs a calendar or contacts server needs. */
+export const HTTP_BASIC_METHODS = new Set(['GET', 'HEAD', 'OPTIONS', 'PROPFIND', 'REPORT', 'PUT', 'DELETE']);
+/** The largest body a Basic-auth request may carry: an event, not an upload. */
+export const HTTP_BASIC_MAX_BODY = 256 * 1024;
+/** The largest answer it may read, whatever the caller asks for. */
+export const HTTP_BASIC_MAX_RESPONSE = 10 * 1024 * 1024;
+/** How many Basic-auth requests one plugin may make with one secret in a minute. */
+export const HTTP_BASIC_PER_MINUTE = 120;
+function asBasicTarget(target) {
+    if (typeof target !== 'object' || target === null)
+        return undefined;
+    const { plugin, host } = target;
+    if (typeof plugin !== 'string' || typeof host !== 'string' || plugin.trim() === '')
+        return undefined;
+    const h = host.toLowerCase();
+    if (h.startsWith('*.')) {
+        if (!/^[a-z0-9-]+(\.[a-z0-9-]+)+$/.test(h.slice(2)))
+            return undefined;
+    }
+    else if (!/^[a-z0-9-]+(\.[a-z0-9-]+)*$/.test(h))
+        return undefined;
+    return { plugin: plugin.trim(), host: h };
+}
+/** Whether a request host is one a bound host names: the same, or under its `*.` domain. */
+export function basicHostCovers(bound, host) {
+    if (bound.startsWith('*.'))
+        return host.endsWith(bound.slice(1)) && host.length > bound.length - 1;
+    return bound === host;
+}
+/** Register `http.basic` under core's own name, beside `http.header` and `http.url`. */
+export function registerHttpBasicDestination() {
+    registerSecretDestination(HTTP_HEADER_PLUGIN, {
+        kind: HTTP_BASIC_KIND,
+        maxRule: 'pre-approved',
+        checkTarget(target, bound) {
+            const asked = asBasicTarget(target);
+            const boundBasic = asBasicTarget(bound);
+            if (asked === undefined || boundBasic === undefined || asked.host.startsWith('*.'))
+                return false;
+            return asked.plugin === boundBasic.plugin && basicHostCovers(boundBasic.host, asked.host);
+        },
+        describe(target) {
+            const asked = asBasicTarget(target);
+            return asked === undefined
+                ? 'the password of a web sign-in'
+                : `the password ${asked.plugin} signs in with at ${asked.host}`;
+        },
+        deliver() {
+            throw new Error('http.basic delivers through the http area itself, never through a destination');
+        },
+    });
+}
+/** Whether a binding names `http.basic` for this plugin (`secrets.put`, since 1.26). */
+export function isOwnBasicBinding(binding, plugin) {
+    return binding.kind === HTTP_BASIC_KIND && asBasicTarget(binding.target)?.plugin === plugin;
+}
+/* ------------------------------------------------------------------ *
+ * The `http.bearer` destination (since host API 1.28)
+ * ------------------------------------------------------------------ */
+/**
+ * Core's own OAuth destination (docs/owner-secrets.md §3): a secret that is
+ * an OAuth sign-in core made for a plugin (`secrets.signIn`) — the token
+ * envelope — sent as `Authorization: Bearer <access token>` to the host its
+ * binding names, refreshed by core at the provider that issued it. The plugin
+ * never holds a token.
+ */
+export const HTTP_BEARER_KIND = 'http.bearer';
+/** The methods a bearer request may use: an API's reads and writes. */
+export const HTTP_BEARER_METHODS = new Set(['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE']);
+/** How many bearer requests one plugin may make with one sign-in in a minute. */
+export const HTTP_BEARER_PER_MINUTE = 300;
+/** Register `http.bearer` under core's own name, beside the other `http.*` kinds. Its target is `http.basic`'s shape. */
+export function registerHttpBearerDestination() {
+    registerSecretDestination(HTTP_HEADER_PLUGIN, {
+        kind: HTTP_BEARER_KIND,
+        maxRule: 'pre-approved',
+        checkTarget(target, bound) {
+            const asked = asBasicTarget(target);
+            const boundBearer = asBasicTarget(bound);
+            if (asked === undefined || boundBearer === undefined || asked.host.startsWith('*.'))
+                return false;
+            return asked.plugin === boundBearer.plugin && basicHostCovers(boundBearer.host, asked.host);
+        },
+        describe(target) {
+            const asked = asBasicTarget(target);
+            return asked === undefined
+                ? 'the sign-in of a web service'
+                : `the sign-in ${asked.plugin} uses at ${asked.host}`;
+        },
+        deliver() {
+            throw new Error('http.bearer delivers through the http area itself, never through a destination');
+        },
+    });
+}
+/** Whether a binding names `http.bearer` for this plugin (written by `secrets.signIn`, since 1.28). */
+export function isOwnBearerBinding(binding, plugin) {
+    return binding.kind === HTTP_BEARER_KIND && asBasicTarget(binding.target)?.plugin === plugin;
+}
 /** A use that waits on the owner: the plugin is told, and may say so onward. */
 export class SecretPendingError extends Error {
     actionId;
@@ -209,6 +319,68 @@ export class SecretPendingError extends Error {
         this.actionId = actionId;
     }
 }
+export function createBasicBudget(perMinute = HTTP_BASIC_PER_MINUTE) {
+    const sent = new Map();
+    return {
+        take(plugin, secret, at) {
+            // Bounded cleanup: whenever the map grows past a handful of keys, drop the stale ones.
+            if (sent.size > 64) {
+                for (const [key, stamps] of sent)
+                    if (stamps.every((t) => at - t >= 60_000))
+                        sent.delete(key);
+            }
+            const key = `${plugin}\u0000${secret}`;
+            const recent = (sent.get(key) ?? []).filter((t) => at - t < 60_000);
+            if (recent.length >= perMinute) {
+                sent.set(key, recent);
+                return false;
+            }
+            recent.push(at);
+            sent.set(key, recent);
+            return true;
+        },
+        refund(plugin, secret, at) {
+            const key = `${plugin}\u0000${secret}`;
+            const stamps = sent.get(key);
+            const i = stamps?.indexOf(at) ?? -1;
+            if (stamps !== undefined && i >= 0)
+                stamps.splice(i, 1);
+            if (stamps !== undefined && stamps.length === 0)
+                sent.delete(key);
+        },
+    };
+}
+const sharedBasicBudget = createBasicBudget();
+const sharedBearerBudget = createBasicBudget(HTTP_BEARER_PER_MINUTE);
+/**
+ * Headers a caller may not set on a request that carries a secret: anything
+ * that names which server or virtual host the request is for (`Host` decides
+ * TLS SNI and a CDN's routing; the forwarding headers decide it behind some
+ * proxies) or that carries a proxy credential. The URL's own host is the only
+ * identity a secret is bound to. `Cookie` stays the caller's: it is the
+ * plugin's own state, never the owner's secret.
+ */
+const IDENTITY_HEADERS = new Set([
+    'host',
+    'x-forwarded-host',
+    'x-forwarded-server',
+    'x-host',
+    'x-original-host',
+    'forwarded',
+    'proxy-authorization',
+]);
+/** The caller's headers without the identity headers and without `drop` (case-insensitive). */
+function withoutIdentity(headers, drop) {
+    const lower = drop.toLowerCase();
+    return Object.fromEntries(Object.entries(headers ?? {}).filter(([name]) => {
+        const n = name.toLowerCase();
+        return n !== lower && !IDENTITY_HEADERS.has(n);
+    }));
+}
+/** A response cap that is a finite, non-negative whole number, or undefined. */
+function validCap(maxBytes) {
+    return typeof maxBytes === 'number' && Number.isSafeInteger(maxBytes) && maxBytes >= 0 ? maxBytes : undefined;
+}
 /** Hosts already said to be undeclared, per plugin, so a loop logs once. */
 const undeclaredSeen = new Set();
 function hostMatches(declared, host) {
@@ -229,6 +401,42 @@ function hostMatches(declared, host) {
 export function createHttpArea(options) {
     const policy = options.policy ?? DEFAULT_POLICY;
     let transport;
+    const basicBudget = options.basicBudget ?? sharedBasicBudget;
+    const bearerBudget = options.bearerBudget ?? sharedBearerBudget;
+    const now = options.now ?? (() => Date.now());
+    /** Send one checked request on the transport; `capped`: a sign-in's answer, at most 10 MB. */
+    const dispatch = (req, url, headers, capped) => {
+        const host = new URL(url).hostname.replace(/^\[|\]$/g, '').toLowerCase();
+        /*
+         * Logged, not refused, in 1.0: the hosts a manifest lists were
+         * documentation until now, and refusing an undeclared one before every
+         * plugin has written its down would break plugins that did nothing
+         * wrong (§4.2).
+         */
+        if (!options.network.some((declared) => hostMatches(declared, host))) {
+            const key = `${options.plugin}\u0000${host}`;
+            if (!undeclaredSeen.has(key)) {
+                undeclaredSeen.add(key);
+                options.log(`a request to ${host}, which its manifest does not declare under network`);
+            }
+        }
+        if (options.transport === undefined) {
+            return Promise.reject(new Error('This process has no HTTP transport for plugins.'));
+        }
+        transport ??= options.transport({ lookup: guardedLookup(options.resolve, policy) });
+        // A cap that is not a whole number of bytes (NaN, Infinity, -1) is no cap at all to the transport: it counts as unset, so the default applies.
+        const cap = validCap(req.maxBytes);
+        return transport(url, {
+            method: req.method ?? 'GET',
+            headers,
+            ...(req.body === undefined ? {} : { body: req.body }),
+            ...(req.signal === undefined ? {} : { signal: req.signal }),
+            ...(req.idleTimeoutMs === undefined ? {} : { idleTimeoutMs: req.idleTimeoutMs }),
+            ...(capped
+                ? { maxBytes: Math.min(cap ?? HTTP_BASIC_MAX_RESPONSE, HTTP_BASIC_MAX_RESPONSE) }
+                : cap === undefined ? {} : { maxBytes: cap }),
+        });
+    };
     return {
         async request(req) {
             let parsedUrl;
@@ -259,6 +467,7 @@ export function createHttpArea(options) {
              */
             let url = req.url;
             let secretUrl;
+            let basicCap = false;
             if (req.auth !== undefined && req.auth.as === 'url') {
                 if (parsedUrl.protocol !== 'https:')
                     throw new Error('a secret goes only into an HTTPS request');
@@ -291,6 +500,114 @@ export function createHttpArea(options) {
                 checkUrl(stored.toString(), policy);
                 url = stored.toString();
                 secretUrl = { name, value: url };
+                // The address is the credential: no caller header may point it at another virtual host.
+                headers = withoutIdentity(req.headers, 'host');
+            }
+            else if (req.auth !== undefined && req.auth.as === 'bearer') {
+                /*
+                 * An OAuth sign-in (`as: 'bearer'`, since 1.28): core reads the token
+                 * envelope the binding allows for this plugin and this host, refreshes
+                 * it at its provider when it is about to expire, and inserts the
+                 * access token itself. A 401 is answered once: refreshed (unless
+                 * another request already did) and sent again. The same fences as a
+                 * Basic sign-in, with an API's verbs.
+                 */
+                if (parsedUrl.protocol !== 'https:')
+                    throw new Error('a secret goes only into an HTTPS request');
+                const method = (req.method ?? 'GET').toUpperCase();
+                if (!HTTP_BEARER_METHODS.has(method)) {
+                    throw new Error(`a sign-in is sent only with ${[...HTTP_BEARER_METHODS].join(', ')}, not ${method}`);
+                }
+                if (req.auth.header !== undefined || req.auth.username !== undefined)
+                    throw new Error('a bearer sign-in always goes into Authorization, with no user name');
+                const size = req.body === undefined ? 0 : typeof req.body === 'string' ? Buffer.byteLength(req.body) : req.body.length;
+                if (size > HTTP_BASIC_MAX_BODY)
+                    throw new Error(`a request with a sign-in carries at most ${HTTP_BASIC_MAX_BODY / 1024} KiB`);
+                const deliverBearer = options.secrets?.deliverBearerFor;
+                if (deliverBearer === undefined)
+                    throw new Error('This process cannot deliver a secret into a request.');
+                const secretName = req.auth.secret;
+                const token = async (rejected) => {
+                    const at = now();
+                    if (!bearerBudget.take(options.plugin, secretName, at)) {
+                        throw new Error(`too many requests with "${secretName}" this minute (at most ${HTTP_BEARER_PER_MINUTE}); try again shortly`);
+                    }
+                    let delivered;
+                    try {
+                        delivered = await deliverBearer(secretName, host, rejected);
+                    }
+                    catch (err) {
+                        bearerBudget.refund(options.plugin, secretName, at);
+                        throw err;
+                    }
+                    if (!('ok' in delivered))
+                        bearerBudget.refund(options.plugin, secretName, at);
+                    if ('pending' in delivered)
+                        throw new SecretPendingError(delivered.pending);
+                    if ('refused' in delivered)
+                        throw new Error(delivered.refused);
+                    return delivered.value;
+                };
+                const base = withoutIdentity(req.headers, 'authorization');
+                const first = await token();
+                const send = (access) => dispatch(req, url, { ...base, Authorization: `Bearer ${access}` }, true);
+                const answer = await send(first);
+                if (answer.status !== 401)
+                    return answer;
+                // Read and drop the 401's body so its connection is free, then once more with a fresh token.
+                await answer.arrayBuffer().catch(() => undefined);
+                return send(await token(first));
+            }
+            else if (req.auth !== undefined && req.auth.as === 'basic') {
+                /*
+                 * A sign-in's password (`as: 'basic'`, since 1.26): the caller names
+                 * the user, core reads the password the binding allows for this
+                 * plugin and this host, and builds the Authorization header itself.
+                 * HTTPS only, the WebDAV verbs and no others, a small body, a capped
+                 * answer and a per-minute budget, so a plugin holding a sign-in
+                 * cannot turn it into an upload channel or a flood.
+                 */
+                if (parsedUrl.protocol !== 'https:')
+                    throw new Error('a secret goes only into an HTTPS request');
+                const method = (req.method ?? 'GET').toUpperCase();
+                if (!HTTP_BASIC_METHODS.has(method)) {
+                    throw new Error(`a sign-in is sent only with ${[...HTTP_BASIC_METHODS].join(', ')}, not ${method}`);
+                }
+                if (req.auth.header !== undefined)
+                    throw new Error('a sign-in always goes into Authorization');
+                const username = req.auth.username;
+                if (typeof username !== 'string' || username.length === 0 || username.length > 256 || /[:\r\n\u0000]/.test(username)) {
+                    throw new Error('a sign-in needs a user name without a colon or a line break');
+                }
+                const size = req.body === undefined ? 0 : typeof req.body === 'string' ? Buffer.byteLength(req.body) : req.body.length;
+                if (size > HTTP_BASIC_MAX_BODY)
+                    throw new Error(`a request with a sign-in carries at most ${HTTP_BASIC_MAX_BODY / 1024} KiB`);
+                if (options.secrets?.deliverBasicFor === undefined) {
+                    throw new Error('This process cannot deliver a secret into a request.');
+                }
+                // Counted before the delivery, so concurrent requests cannot all slip
+                // under the line; given back when no password is delivered.
+                const at = now();
+                if (!basicBudget.take(options.plugin, req.auth.secret, at)) {
+                    throw new Error(`too many requests with "${req.auth.secret}" this minute (at most ${HTTP_BASIC_PER_MINUTE}); try again shortly`);
+                }
+                let delivered;
+                try {
+                    delivered = await options.secrets.deliverBasicFor(req.auth.secret, host);
+                }
+                catch (err) {
+                    basicBudget.refund(options.plugin, req.auth.secret, at);
+                    throw err;
+                }
+                if (!('ok' in delivered))
+                    basicBudget.refund(options.plugin, req.auth.secret, at);
+                if ('pending' in delivered)
+                    throw new SecretPendingError(delivered.pending);
+                if ('refused' in delivered)
+                    throw new Error(delivered.refused);
+                headers = withoutIdentity(req.headers, 'authorization');
+                headers.Authorization = `Basic ${Buffer.from(`${username}:${delivered.value}`, 'utf8').toString('base64')}`;
+                basicCap = true;
             }
             else if (req.auth !== undefined) {
                 if (parsedUrl.protocol !== 'https:') {
@@ -306,34 +623,12 @@ export function createHttpArea(options) {
                 if ('refused' in delivered)
                     throw new Error(delivered.refused);
                 // The caller's own spelling of the same header goes, whatever its case: one header, the bound value.
-                headers = Object.fromEntries(Object.entries(req.headers ?? {}).filter(([name]) => name.toLowerCase() !== headerName.toLowerCase()));
+                if (IDENTITY_HEADERS.has(headerName.toLowerCase()))
+                    throw new Error(`a secret cannot go into ${headerName}`);
+                headers = withoutIdentity(req.headers, headerName);
                 headers[headerName] = delivered.value;
             }
-            /*
-             * Logged, not refused, in 1.0: the hosts a manifest lists were
-             * documentation until now, and refusing an undeclared one before every
-             * plugin has written its down would break plugins that did nothing
-             * wrong (§4.2).
-             */
-            if (!options.network.some((declared) => hostMatches(declared, host))) {
-                const key = `${options.plugin}\u0000${host}`;
-                if (!undeclaredSeen.has(key)) {
-                    undeclaredSeen.add(key);
-                    options.log(`a request to ${host}, which its manifest does not declare under network`);
-                }
-            }
-            if (options.transport === undefined) {
-                throw new Error('This process has no HTTP transport for plugins.');
-            }
-            transport ??= options.transport({ lookup: guardedLookup(options.resolve, policy) });
-            const sent = transport(url, {
-                method: req.method ?? 'GET',
-                headers: headers ?? {},
-                ...(req.body === undefined ? {} : { body: req.body }),
-                ...(req.signal === undefined ? {} : { signal: req.signal }),
-                ...(req.idleTimeoutMs === undefined ? {} : { idleTimeoutMs: req.idleTimeoutMs }),
-                ...(req.maxBytes === undefined ? {} : { maxBytes: req.maxBytes }),
-            });
+            const sent = dispatch(req, url, headers ?? {}, basicCap);
             if (secretUrl === undefined)
                 return sent;
             const { name, value } = secretUrl;

package/node_modules/@buddi/core/dist/host/http.js.map

@@ -1 +1 @@
-{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/host/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAsB,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAYvE,MAAM,UAAU,GAAc,CAAC,QAAQ,EAAE,EAAE,CACzC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAqB,UAAU,EAC/B,SAAwB,cAAc;IAEtC,OAAO,SAAS,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ;QAChD,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,IAAI,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAG3E,CAAC;QACF,MAAM,IAAI,GAAG,QAIJ,CAAC;QAEV,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,YAAY,CAAC,UAAU,EAAE,wBAAwB,QAAQ,gDAAgD,CAAC,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QAED,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpB,CAAC,OAAO,EAAE,EAAE;YACV,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,YAAY,CAAC,cAAc,EAAE,IAAI,QAAQ,0BAA0B,CAAC,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;oBACjB,IAAI,CACF,IAAI,YAAY,CACd,iBAAiB,EACjB,aAAa,QAAQ,qBAAqB,MAAM,CAAC,OAAO,cAAc,GAAG,IAAI;wBAC3E,sGAAsG,CACzG,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBACpC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;gBACjD,CAAC,CAAC,OAAO,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACpD,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;gBACtB,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAwC,CAAC;YAC/D,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,IAAI,CACF,IAAI,YAAY,CACd,cAAc,EACd,sBAAsB,QAAQ,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAmB,CAAC;AACtB,CAAC;AAED;;wEAEwE;AAExE,gEAAgE;AAChE,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAC9C,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAQzC,sEAAsE;AACtE,SAAS,cAAc,CAAC,MAAe;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAiC,CAAC;IAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7E,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAChH,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B;IAC3C,yBAAyB,CAAC,kBAAkB,EAAE;QAC5C,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,cAAc;QACvB,WAAW,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACnE,OAAO,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5G,CAAC;QACD,QAAQ,CAAC,MAAM;YACb,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,KAAK,KAAK,SAAS;gBACxB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,0BAA0B,KAAK,CAAC,IAAI,EAAE,CAAC;QAChE,CAAC;QACD,OAAO;YACL,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;wEAEwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAaxC,SAAS,WAAW,CAAC,MAAe;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAiC,CAAC;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7E,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACzF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,0BAA0B;IACxC,yBAAyB,CAAC,kBAAkB,EAAE;QAC5C,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,cAAc;QACvB,WAAW,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAChE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;QAC1E,CAAC;QACD,QAAQ,CAAC,MAAM;YACb,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO,KAAK,KAAK,SAAS;gBACxB,CAAC,CAAC,8BAA8B;gBAChC,CAAC,CAAC,2BAA2B,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,IAAI,EAAE,CAAC;QACvE,CAAC;QACD,OAAO;YACL,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,eAAe,CAAC,OAA0C,EAAE,MAAc;IACxF,OAAO,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;AAC1F,CAAC;AAoBD,gFAAgF;AAChF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEtB;IADH,IAAI,GAAG,oBAAoB,CAAC;IAC9C,YAAqB,QAAgB;QACnC,KAAK,CAAC,sDAAsD,QAAQ,iCAAiC,CAAC,CAAC;QADpF,aAAQ,GAAR,QAAQ,CAAQ;IAErC,CAAC;CACF;AA6CD,4EAA4E;AAC5E,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;AAEzC,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACzG,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;IAChD,IAAI,SAA0C,CAAC;IAC/C,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,SAAc,CAAC;YACnB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,IAAI,GAAW,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5E,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1B;;;;;;eAMG;YACH,IAAI,OAAO,GAAuC,GAAG,CAAC,OAAO,CAAC;YAC9D;;;;;;;;eAQG;YACH,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;YAClB,IAAI,SAAsD,CAAC;YAC3D,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACpD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBACjG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC5E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAC3G,IAAI,OAAO,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;oBACjD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC7E,IAAI,SAAS,IAAI,SAAS;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5E,IAAI,SAAS,IAAI,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC7B,IAAI,MAAW,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,yBAAyB,CAAC,CAAC;gBACrD,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,+CAA+C,CAAC,CAAC;gBAC3G,IAAI,UAAU,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,eAAe,UAAU,SAAS,IAAI,GAAG,CAAC,CAAC;gBAC5F,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;gBACpC,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACxB,SAAS,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;YACnC,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,CAAC;gBACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;gBACtD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAChD,GAAG,CAAC,IAAI,CAAC,MAAM,EACf,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EACxD,UAAU,CACX,CAAC;gBACF,IAAI,SAAS,IAAI,SAAS;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5E,IAAI,SAAS,IAAI,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC/D,qGAAqG;gBACrG,OAAO,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;gBACpI,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;YACxC,CAAC;YACD;;;;;eAKG;YACH,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;gBACrE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,SAAS,IAAI,EAAE,CAAC;gBAC7C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;oBAC7B,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;oBACxB,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,qDAAqD,CAAC,CAAC;gBACzF,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;gBACpC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YACrE,CAAC;YACD,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACpF,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,EAAE;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;gBAC3B,OAAO,EAAE,OAAO,IAAI,EAAE;gBACtB,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;gBAChF,GAAG,CAAC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,CAAC;aAClE,CAAC,CAAC;YACH,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC;gBAC7D,IAAI,MAAM,KAAK,OAAO;oBAAE,MAAM,GAAG,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC9G,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"http.js","sourceRoot":"","sources":["../../src/host/http.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AACH,OAAO,GAAG,MAAM,UAAU,CAAC;AAE3B,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,QAAQ,EAAsB,MAAM,kBAAkB,CAAC;AAC9F,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AAYvE,MAAM,UAAU,GAAc,CAAC,QAAQ,EAAE,EAAE,CACzC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;AAE/D;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,aAAa,CAC3B,UAAqB,UAAU,EAC/B,SAAwB,cAAc;IAEtC,OAAO,SAAS,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ;QAChD,wEAAwE;QACxE,uDAAuD;QACvD,MAAM,IAAI,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAG3E,CAAC;QACF,MAAM,IAAI,GAAG,QAIJ,CAAC;QAEV,IAAI,MAAM,CAAC,eAAe,CAAC,QAAQ,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,IAAI,YAAY,CAAC,UAAU,EAAE,wBAAwB,QAAQ,gDAAgD,CAAC,CAAC,CAAC;YACrH,OAAO;QACT,CAAC;QAED,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CACpB,CAAC,OAAO,EAAE,EAAE;YACV,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,IAAI,CAAC,IAAI,YAAY,CAAC,cAAc,EAAE,IAAI,QAAQ,0BAA0B,CAAC,CAAC,CAAC;gBAC/E,OAAO;YACT,CAAC;YACD,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;gBAC7B,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAC3C,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;oBACjB,IAAI,CACF,IAAI,YAAY,CACd,iBAAiB,EACjB,aAAa,QAAQ,qBAAqB,MAAM,CAAC,OAAO,cAAc,GAAG,IAAI;wBAC3E,sGAAsG,CACzG,CACF,CAAC;oBACF,OAAO;gBACT,CAAC;YACH,CAAC;YACD,MAAM,MAAM,GACV,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBACpC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;gBACjD,CAAC,CAAC,OAAO,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YACpD,IAAI,IAAI,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;gBACtB,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC1E,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAwC,CAAC;YAC/D,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC1C,CAAC,EACD,CAAC,GAAY,EAAE,EAAE;YACf,IAAI,CACF,IAAI,YAAY,CACd,cAAc,EACd,sBAAsB,QAAQ,MAAM,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACvF,CACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAmB,CAAC;AACtB,CAAC;AAED;;wEAEwE;AAExE,gEAAgE;AAChE,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAC9C,wEAAwE;AACxE,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAQzC,sEAAsE;AACtE,SAAS,cAAc,CAAC,MAAe;IACrC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAiC,CAAC;IAC3D,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7E,IAAI,CAAC,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAChH,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B;IAC3C,yBAAyB,CAAC,kBAAkB,EAAE;QAC5C,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,cAAc;QACvB,WAAW,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACrC,MAAM,WAAW,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;YAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YACnE,OAAO,KAAK,CAAC,IAAI,KAAK,WAAW,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,WAAW,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QAC5G,CAAC;QACD,QAAQ,CAAC,MAAM;YACb,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC;YACrC,OAAO,KAAK,KAAK,SAAS;gBACxB,CAAC,CAAC,wBAAwB;gBAC1B,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,0BAA0B,KAAK,CAAC,IAAI,EAAE,CAAC;QAChE,CAAC;QACD,OAAO;YACL,yEAAyE;YACzE,uEAAuE;YACvE,wEAAwE;YACxE,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;wEAEwE;AAExE;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,UAAU,CAAC;AAaxC,SAAS,WAAW,CAAC,MAAe;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAiC,CAAC;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC7E,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACzF,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;AAC7D,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,0BAA0B;IACxC,yBAAyB,CAAC,kBAAkB,EAAE;QAC5C,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,cAAc;QACvB,WAAW,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACpC,IAAI,KAAK,KAAK,SAAS,IAAI,QAAQ,KAAK,SAAS;gBAAE,OAAO,KAAK,CAAC;YAChE,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC;QAC1E,CAAC;QACD,QAAQ,CAAC,MAAM;YACb,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YAClC,OAAO,KAAK,KAAK,SAAS;gBACxB,CAAC,CAAC,8BAA8B;gBAChC,CAAC,CAAC,2BAA2B,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,IAAI,EAAE,CAAC;QACvE,CAAC;QACD,OAAO;YACL,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACjG,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,eAAe,CAAC,OAA0C,EAAE,MAAc;IACxF,OAAO,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;AAC1F,CAAC;AAED;;wEAEwE;AAExE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,gHAAgH;AAChH,MAAM,CAAC,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC;AAClI,gFAAgF;AAChF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC;AAC9C,oEAAoE;AACpE,MAAM,CAAC,MAAM,uBAAuB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AACxD,oFAAoF;AACpF,MAAM,CAAC,MAAM,qBAAqB,GAAG,GAAG,CAAC;AAYzC,SAAS,aAAa,CAAC,MAAe;IACpC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACpE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAiC,CAAC;IAC3D,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACrG,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;IACxE,CAAC;SAAM,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IACpE,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,eAAe,CAAC,KAAa,EAAE,IAAY;IACzD,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;IACnG,OAAO,KAAK,KAAK,IAAI,CAAC;AACxB,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,4BAA4B;IAC1C,yBAAyB,CAAC,kBAAkB,EAAE;QAC5C,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,cAAc;QACvB,WAAW,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,UAAU,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACxC,IAAI,KAAK,KAAK,SAAS,IAAI,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjG,OAAO,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,MAAM,IAAI,eAAe,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC5F,CAAC;QACD,QAAQ,CAAC,MAAM;YACb,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO,KAAK,KAAK,SAAS;gBACxB,CAAC,CAAC,+BAA+B;gBACjC,CAAC,CAAC,gBAAgB,KAAK,CAAC,MAAM,qBAAqB,KAAK,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC;QACD,OAAO;YACL,MAAM,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC;QACnG,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,wFAAwF;AACxF,MAAM,UAAU,iBAAiB,CAAC,OAA0C,EAAE,MAAc;IAC1F,OAAO,OAAO,CAAC,IAAI,KAAK,eAAe,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;AAC9F,CAAC;AAED;;wEAEwE;AAExE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAE9C,uEAAuE;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAwB,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;AACnH,iFAAiF;AACjF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,CAAC;AAE1C,yHAAyH;AACzH,MAAM,UAAU,6BAA6B;IAC3C,yBAAyB,CAAC,kBAAkB,EAAE;QAC5C,IAAI,EAAE,gBAAgB;QACtB,OAAO,EAAE,cAAc;QACvB,WAAW,CAAC,MAAM,EAAE,KAAK;YACvB,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACpC,MAAM,WAAW,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;YACzC,IAAI,KAAK,KAAK,SAAS,IAAI,WAAW,KAAK,SAAS,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAClG,OAAO,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,MAAM,IAAI,eAAe,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC9F,CAAC;QACD,QAAQ,CAAC,MAAM;YACb,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;YACpC,OAAO,KAAK,KAAK,SAAS;gBACxB,CAAC,CAAC,8BAA8B;gBAChC,CAAC,CAAC,eAAe,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,IAAI,EAAE,CAAC;QAC1D,CAAC;QACD,OAAO;YACL,MAAM,IAAI,KAAK,CAAC,gFAAgF,CAAC,CAAC;QACpG,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,kBAAkB,CAAC,OAA0C,EAAE,MAAc;IAC3F,OAAO,OAAO,CAAC,IAAI,KAAK,gBAAgB,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC;AAC/F,CAAC;AAoCD,gFAAgF;AAChF,MAAM,OAAO,kBAAmB,SAAQ,KAAK;IAEtB;IADH,IAAI,GAAG,oBAAoB,CAAC;IAC9C,YAAqB,QAAgB;QACnC,KAAK,CAAC,sDAAsD,QAAQ,iCAAiC,CAAC,CAAC;QADpF,aAAQ,GAAR,QAAQ,CAAQ;IAErC,CAAC;CACF;AAiED,MAAM,UAAU,iBAAiB,CAAC,SAAS,GAAG,qBAAqB;IACjE,MAAM,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,OAAO;QACL,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YACrB,uFAAuF;YACvF,IAAI,IAAI,CAAC,IAAI,GAAG,EAAE,EAAE,CAAC;gBACnB,KAAK,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,IAAI;oBAAE,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC;wBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChG,CAAC;YACD,MAAM,GAAG,GAAG,GAAG,MAAM,SAAS,MAAM,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC;YACpE,IAAI,MAAM,CAAC,MAAM,IAAI,SAAS,EAAE,CAAC;gBAC/B,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YAChB,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACtB,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE;YACvB,MAAM,GAAG,GAAG,GAAG,MAAM,SAAS,MAAM,EAAE,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,iBAAiB,GAAG,iBAAiB,EAAE,CAAC;AAC9C,MAAM,kBAAkB,GAAG,iBAAiB,CAAC,sBAAsB,CAAC,CAAC;AAErE;;;;;;;GAOG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,MAAM;IACN,kBAAkB;IAClB,oBAAoB;IACpB,QAAQ;IACR,iBAAiB;IACjB,WAAW;IACX,qBAAqB;CACtB,CAAC,CAAC;AAEH,+FAA+F;AAC/F,SAAS,eAAe,CAAC,OAA2C,EAAE,IAAY;IAChF,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QAC7B,OAAO,CAAC,KAAK,KAAK,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,SAAS,QAAQ,CAAC,QAAiB;IACjC,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;AAChH,CAAC;AAED,4EAA4E;AAC5E,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;AAEzC,SAAS,WAAW,CAAC,QAAgB,EAAE,IAAY;IACjD,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IACzG,OAAO,OAAO,KAAK,IAAI,CAAC;AAC1B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,cAAc,CAAC,OAAwB;IACrD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,cAAc,CAAC;IAChD,IAAI,SAA0C,CAAC;IAC/C,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAC7D,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,kBAAkB,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC9C,8FAA8F;IAC9F,MAAM,QAAQ,GAAG,CAAC,GAAgB,EAAE,GAAW,EAAE,OAA+B,EAAE,MAAe,EAAyB,EAAE;QAC1H,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;QACzE;;;;;WAKG;QACH,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC;YACrE,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,MAAM,SAAS,IAAI,EAAE,CAAC;YAC7C,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACxB,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,qDAAqD,CAAC,CAAC;YACzF,CAAC;QACH,CAAC;QACD,IAAI,OAAO,CAAC,SAAS,KAAK,SAAS,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;QACtF,CAAC;QACD,SAAS,KAAK,OAAO,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACpF,+IAA+I;QAC/I,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnC,OAAO,SAAS,CAAC,GAAG,EAAE;YACpB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,KAAK;YAC3B,OAAO;YACP,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;YACrD,GAAG,CAAC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3D,GAAG,CAAC,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,aAAa,EAAE,CAAC;YAChF,GAAG,CAAC,MAAM;gBACR,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,uBAAuB,EAAE,uBAAuB,CAAC,EAAE;gBACjF,CAAC,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC;SAChD,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,OAAO,CAAC,GAAG;YACf,IAAI,SAAc,CAAC;YACnB,IAAI,CAAC;gBACH,SAAS,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YAC/B,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CAAC,sBAAsB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;YACzF,CAAC;YACD,IAAI,IAAI,GAAW,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;YAC5E,QAAQ,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC1B;;;;;;eAMG;YACH,IAAI,OAAO,GAAuC,GAAG,CAAC,OAAO,CAAC;YAC9D;;;;;;;;eAQG;YACH,IAAI,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC;YAClB,IAAI,SAAsD,CAAC;YAC3D,IAAI,QAAQ,GAAG,KAAK,CAAC;YACrB,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACpD,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBACjG,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,KAAK,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;oBAC5E,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;gBACtE,CAAC;gBACD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAC3G,IAAI,OAAO,CAAC,OAAO,EAAE,aAAa,KAAK,SAAS,EAAE,CAAC;oBACjD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC7E,IAAI,SAAS,IAAI,SAAS;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5E,IAAI,SAAS,IAAI,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC/D,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBAC7B,IAAI,MAAW,CAAC;gBAChB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;gBAC3C,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,yBAAyB,CAAC,CAAC;gBACrD,CAAC;gBACD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;gBACzE,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,+CAA+C,CAAC,CAAC;gBAC3G,IAAI,UAAU,KAAK,IAAI;oBAAE,MAAM,IAAI,KAAK,CAAC,IAAI,IAAI,eAAe,UAAU,SAAS,IAAI,GAAG,CAAC,CAAC;gBAC5F,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,MAAM,CAAC,CAAC;gBACpC,GAAG,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACxB,SAAS,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;gBACjC,wFAAwF;gBACxF,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC9D;;;;;;;mBAOG;gBACH,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBACjG,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnD,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACrC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,GAAG,mBAAmB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;gBACvG,CAAC;gBACD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAC;gBAC5J,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBACvH,IAAI,IAAI,GAAG,mBAAmB;oBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,mBAAmB,GAAG,IAAI,MAAM,CAAC,CAAC;gBAC9H,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,EAAE,gBAAgB,CAAC;gBACxD,IAAI,aAAa,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBACzG,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBACnC,MAAM,KAAK,GAAG,KAAK,EAAE,QAAiB,EAAmB,EAAE;oBACzD,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;oBACjB,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,EAAE,CAAC;wBACvD,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,0BAA0B,sBAAsB,sBAAsB,CAAC,CAAC;oBAC/H,CAAC;oBACD,IAAI,SAAmF,CAAC;oBACxF,IAAI,CAAC;wBACH,SAAS,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;oBAC9D,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;wBACpD,MAAM,GAAG,CAAC;oBACZ,CAAC;oBACD,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC;wBAAE,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;oBAC9E,IAAI,SAAS,IAAI,SAAS;wBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;oBAC5E,IAAI,SAAS,IAAI,SAAS;wBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;oBAC/D,OAAO,SAAS,CAAC,KAAK,CAAC;gBACzB,CAAC,CAAC;gBACF,MAAM,IAAI,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;gBAC3D,MAAM,KAAK,GAAG,MAAM,KAAK,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,CAAC,MAAc,EAAyB,EAAE,CACrD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;gBAC3E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,CAAC;gBACjC,IAAI,MAAM,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,MAAM,CAAC;gBACzC,6FAA6F;gBAC7F,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClD,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YAClC,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,IAAI,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,OAAO,EAAE,CAAC;gBAC7D;;;;;;;mBAOG;gBACH,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBACjG,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;gBACnD,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,GAAG,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC;gBACtG,CAAC;gBACD,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC/F,MAAM,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC;gBACnC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;oBACrH,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;gBACjF,CAAC;gBACD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;gBACvH,IAAI,IAAI,GAAG,mBAAmB;oBAAE,MAAM,IAAI,KAAK,CAAC,4CAA4C,mBAAmB,GAAG,IAAI,MAAM,CAAC,CAAC;gBAC9H,IAAI,OAAO,CAAC,OAAO,EAAE,eAAe,KAAK,SAAS,EAAE,CAAC;oBACnD,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAC1E,CAAC;gBACD,sEAAsE;gBACtE,4DAA4D;gBAC5D,MAAM,EAAE,GAAG,GAAG,EAAE,CAAC;gBACjB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,CAAC;oBAC3D,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,IAAI,CAAC,MAAM,0BAA0B,qBAAqB,sBAAsB,CAAC,CAAC;gBACnI,CAAC;gBACD,IAAI,SAAkF,CAAC;gBACvF,IAAI,CAAC;oBACH,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;gBAC3E,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;oBACxD,MAAM,GAAG,CAAC;gBACZ,CAAC;gBACD,IAAI,CAAC,CAAC,IAAI,IAAI,SAAS,CAAC;oBAAE,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAClF,IAAI,SAAS,IAAI,SAAS;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5E,IAAI,SAAS,IAAI,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC/D,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;gBACxD,OAAO,CAAC,aAAa,GAAG,SAAS,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,SAAS,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;gBAC5G,QAAQ,GAAG,IAAI,CAAC;YAClB,CAAC;iBAAM,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAClC,IAAI,SAAS,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;oBACpC,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;gBAC9D,CAAC;gBACD,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,eAAe,CAAC;gBACtD,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;oBAClC,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;gBAC1E,CAAC;gBACD,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,UAAU,CAChD,GAAG,CAAC,IAAI,CAAC,MAAM,EACf,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EACxD,UAAU,CACX,CAAC;gBACF,IAAI,SAAS,IAAI,SAAS;oBAAE,MAAM,IAAI,kBAAkB,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC5E,IAAI,SAAS,IAAI,SAAS;oBAAE,MAAM,IAAI,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;gBAC/D,qGAAqG;gBACrG,IAAI,gBAAgB,CAAC,GAAG,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,UAAU,EAAE,CAAC,CAAC;gBAC7G,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;gBACnD,OAAO,CAAC,UAAU,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;YACxC,CAAC;YACD,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;YACzD,IAAI,SAAS,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACzC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC;YAClC,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE;gBACjC,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,GAAG,CAAC,CAAC;gBAC7D,IAAI,MAAM,KAAK,OAAO;oBAAE,MAAM,GAAG,CAAC;gBAClC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;YAC9G,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC"}

package/node_modules/@buddi/core/dist/host/types.d.ts

@@ -14,6 +14,9 @@
  * `@buddi/core/plugin`.
  */
 import type { OwnerPlace } from '../places.js';
+import type { PluginAsset } from '../plugin/assets.js';
+import type { OAuthProvider, OAuthSignInRequest, OAuthSignInStart, OAuthSignInStatus } from '../plugin/sign-in.js';
+import type { Vault } from '../vault/types.js';
 import type { ToolPermission } from '../actions/permissions.js';
 import type { ArtifactKind, ArtifactRow, ArtifactSource } from '../artifacts/store.js';
 import type { ProposePolicyInput } from '../learning/policies.js';
@@ -64,8 +67,10 @@ export interface BuddiHost {
     secrets?: SecretsArea;
     /** Declared as `owner:channel`. Since 1.3. */
     channels?: ChannelsArea;
-    /** Present when the manifest declares `requires`. Since 1.18. */
+    /** Present when the manifest declares `requires` (1.18) or `optional` (1.27). */
     plugins?: PluginsArea;
+    /** Declared as `assets`. Since 1.27. */
+    assets?: AssetsArea;
 }
 /** Who this installation belongs to, and what they said about themselves. */
 export interface OwnerArea {
@@ -122,10 +127,37 @@ export interface PluginsArea {
     /**
      * Call `plugin`'s export `name` with `args`, validated by the export's own
      * parameters. Refused — a `PluginCallRefusal` naming why — when `plugin` is
-     * not in this manifest's `requires`, is not loaded, is outside the range,
-     * or exports no such name. A write inside it fails as a page query's does.
+     * not in this manifest's `requires` or `optional`, is not loaded, is outside
+     * the range, or exports no such name. A write inside it fails as a page
+     * query's does.
      */
     call<T = unknown>(plugin: string, name: string, args?: unknown): Promise<T>;
+    /**
+     * Whether `plugin` — one this manifest names in `requires` or `optional` —
+     * is loaded now, at a version in the range. False for any other name. For a
+     * plugin that adapts to another being there ("Needs Speech"). Since 1.27;
+     * absent before.
+     */
+    has?(plugin: string): boolean;
+}
+/**
+ * Small images this plugin fetched — an outlet's logo — kept by core and
+ * served by buddi (since 1.27), so a page or a widget draws them without the
+ * dashboard reaching the host they came from. Declared as `assets`.
+ *
+ * `put` takes PNG, JPEG, GIF (its first frame) or ICO, at most 256 KB, and
+ * refuses SVG; core decodes it and keeps PNGs it drew itself, 64 and 128
+ * pixels square, served session-gated at `/api/plugin-assets/<plugin>/<key>`.
+ * 20 MB per plugin; everything is removed with the plugin. Refusals are
+ * thrown with the sentence why.
+ */
+export interface AssetsArea {
+    /** Keep `bytes` under `key` (lower case, digits, `.`, `_`, `-`), replacing what was there. */
+    put(key: string, bytes: Buffer, mime: string): Promise<PluginAsset>;
+    /** Delete one. False when there was none. */
+    delete(key: string): Promise<boolean>;
+    /** Every asset this plugin keeps. */
+    list(): Promise<PluginAsset[]>;
 }
 /**
  * What a plugin may say to the owner: an urgency, a title, a few lines, a
@@ -288,11 +320,30 @@ export interface HttpRequest {
      * address instead, once it is HTTPS on that same host and passes the
      * address rules. GET only, no body, no `header`; the binding names this
      * plugin and the host, so no other plugin can fetch it.
+     *
+     * `as: 'basic'` (since 1.26): the secret is a password (`http.basic`), and
+     * core sends `Authorization: Basic base64(username:password)` with the
+     * `username` the caller names — a CalDAV account's app-specific password.
+     * HTTPS only; GET, HEAD, OPTIONS, PROPFIND, REPORT, PUT or DELETE; a body
+     * of at most 256 KiB; an answer of at most 10 MB; 120 requests a minute per
+     * secret. The binding names this plugin and the host (or `*.` a domain),
+     * so no other plugin can sign in with it.
+     *
+     * `as: 'bearer'` (since 1.28): the secret is an OAuth sign-in core made
+     * with `secrets.signIn` (`http.bearer`), and core sends `Authorization:
+     * Bearer <access token>`, refreshing the token at the provider first when
+     * it is about to expire, and once more — then sending again — when the
+     * answer is 401. HTTPS only, to the host the binding names; GET, HEAD,
+     * POST, PUT, PATCH or DELETE; a body of at most 256 KiB; an answer of at
+     * most 10 MB; 300 requests a minute per secret. When the provider refuses
+     * the refresh (revoked, expired), the request throws `SignInExpiredError`
+     * (`code: 'sign-in-expired'`): the owner signs in again.
      */
     auth?: {
         secret: string;
         header?: string;
-        as?: 'header' | 'url';
+        as?: 'header' | 'url' | 'basic' | 'bearer';
+        username?: string;
     };
     body?: string | Buffer;
     signal?: AbortSignal;
@@ -558,6 +609,65 @@ export interface SecretsArea {
     rebind(name: string, bindings: SecretBinding[]): Promise<boolean>;
     /** Owner only. Delete a secret bound only to this plugin's kinds, value and all. */
     delete(name: string): Promise<boolean>;
+    /**
+     * Owner only (1.28; with `http` declared). Start an OAuth sign-in to one of
+     * core's providers (`OAUTH_PROVIDERS`): PKCE and a state, core listening on
+     * a loopback port for the provider's answer. The tokens never reach the
+     * plugin: core keeps them as the owner secret `secret`, bound to
+     * `http.bearer` for this plugin and `host`, and sends them with `auth: {
+     * secret, as: 'bearer' }`. Signing in again under the same secret replaces
+     * the tokens and keeps the name. Absent on an older buddi.
+     */
+    signIn?(req: OAuthSignInRequest): Promise<OAuthSignInStart>;
+    /** Where one of this plugin's sign-ins stands; `expired` once it is gone. */
+    signInStatus?(id: string): Promise<OAuthSignInStatus>;
+    /**
+     * Owner only. Finish a sign-in with what the owner pasted: the address the
+     * provider sent the browser to (when that browser is on another computer,
+     * the loopback page does not load) or the code alone.
+     */
+    signInFinish?(id: string, pasted: string): Promise<OAuthSignInStatus>;
+    /** Owner only. Drop a sign-in that is still waiting. */
+    signInCancel?(id: string): Promise<void>;
+}
+/**
+ * How core runs a plugin's OAuth sign-in and keeps its tokens fresh: the
+ * loopback listener, PKCE, the code exchange and the refresh. Built by the
+ * composition root over `@buddi/runtime`'s OAuth pieces (core may not import
+ * the runtime) and handed in with `configurePluginHost({ signIns })`. Never a
+ * plugin's surface: the `secrets` area scopes every call to its plugin, and
+ * `save` is core writing the owner secret.
+ */
+export interface PluginSignInService {
+    begin(input: {
+        plugin: string;
+        provider: OAuthProvider;
+        clientId: string;
+        clientSecret?: string;
+        scopes: readonly string[];
+        /** Keep the envelope (JSON): core writes it as the owner secret. */
+        save(envelope: string): Promise<void>;
+    }): Promise<{
+        id: string;
+        authorizeUrl: string;
+        redirectUri: string;
+        expiresAt: number;
+    }>;
+    status(plugin: string, id: string): OAuthSignInStatus | undefined;
+    finish(plugin: string, id: string, pasted: string): Promise<OAuthSignInStatus>;
+    cancel(plugin: string, id: string): void;
+    /**
+     * The access token under vault entry `ref`, refreshed first when it expires
+     * within five minutes, or when `rejected` is the token stored (a 401
+     * answered it). Throws `SignInExpiredError` when the provider refuses the
+     * refresh. `refreshed` says the entry changed (the scrubber rebuilds).
+     */
+    fresh(vault: Pick<Vault, 'get' | 'set'>, ref: string, secret: string, opts?: {
+        rejected?: string;
+    }): Promise<{
+        accessToken: string;
+        refreshed: boolean;
+    }>;
 }
 /**
  * A way to reach the owner that this plugin carries: its mail account, a